I'd argue it's very much on the browser vendors, because they create the strong expectation that everyone is supposed to always be using the latest version. They do this by bundling together feature updates and security updates. Web devs do the pragmatic thing and ignore feature detection, because they know users are constantly being told to update their browsers to keep themselves safe.